Platform keys

The public certificates that let anyone verify the platform’s signatures without trusting us.

Every block of an election’s chain is signed by Condorcet.Vote in the OpenPGP v6 format (RFC 9580, Ed25519). These public certificates let anyone verify those signatures independently. They are the human counterpart of our machine .well-known endpoint.

Protocol v1

The keyring

The signing certificates.

A single key is active: it signs new blocks. During a rotation, the previous key is retired but stays published: its certificate carries an OpenPGP expiration at the moment of retirement, and the blocks it signed remain verifiable forever.

Key …823E8A664BD39588

Active

In service Signs new blocks

OpenPGP v6 fingerprint (SHA-256)

84A2 5BF8 B110 2694 742F E190 55B1 1476 9188 4ABB 3FD5 6FE7 823E 8A66 4BD3 9588

Public certificate (armored) Show

Programmatic access

The same keyring, in OpenPGP.

To automate verification, the armored certificates are served concatenated at a stable URL, first-party (same domain). It is the machine counterpart of this page.

Endpoint · application/pgp-keys

https://admin.stg.condorcet.vote/.well-known/blockchain-signing-key

Stable URL. Served on the main domain, with no third-party redirect.

How to verify

One command, with standard tools.

A block’s signature is a detached OpenPGP v6 (Ed25519) signature over the exact bytes of the published file; the chaining relies on its SHA3-512 digest. Verification uses Sequoia (sq) or any RFC 9580 implementation (GnuPG does not read the v6 format yet).

1

Fetch the block, its sidecars and the keyring The block {n}.json, its signature {n}.json.sig and its timestamp proof {n}.json.ots from the election’s public register; the certificates from the .well-known endpoint.

2

Verify the OpenPGP signature sq verify: the standard validity rules reject a signature dated outside its key’s window.

3

Verify the SHA3-512 chaining The previous block’s digest (openssl dgst -sha3-512) must equal the next block’s previous_hash.

4

Verify the Bitcoin anchoring (OpenTimestamps) ots verify: the .ots proof demonstrates the block existed at its publication date, independently of the platform.

Security & cryptography → The blockchain specifications → Open source libraries →

Verification · shell

# 1 · the block, its sidecars and the published keyring
BLOCK=3.json ; SIG=3.json.sig ; OTS=3.json.ots
curl -s https://condorcet.vote/.well-known/blockchain-signing-key > keys.pgp

# 2 · verify the OpenPGP v6 signature (Sequoia; GnuPG cannot read v6)
sq verify --signer-file keys.pgp --signature-file "$SIG" "$BLOCK"

# 3 · the chaining: the block's digest must equal the next block's previous_hash
openssl dgst -sha3-512 "$BLOCK"

# 4 · the Bitcoin anchoring: the block's OpenTimestamps proof
ots verify -f "$BLOCK" "$OTS"

Platform keys

The signing certificates.

Key …823E8A664BD39588

The same keyring, in OpenPGP.

One command, with standard tools.

See also